About Netsweeper 6.3 New Features Combined
Tile/Table View for WebAdmin Tables
New Search: Contains Any and Contains All
Authentication Redirect -Moved IP Address Expire Time
Account Templates (formerly Permission Templates)
Report Wizard has been Removed
Trend Columns in Scheduled Reports
Additional Information on Trend Fields
GZipped CSV Replaces Zipped CSV
Advanced Filter Added to Reporter
Settings Button added to Create Report and Quick Search
'Edited At' and 'View Count' Columns Added
WebAdmin Setting - Maximum WebAdmin Report Table Rows
URL Lookup in Reviewed Categorized List
Maximum URLs to Lookup at once
Action List and Restrict Actions
Keeping the nfmark or the ip tos field from client to remote server
NSProxy Truncates HTTP Request Headers
Client Filter Settings in the WebAdmin
Create Group with default setting if it doesn't exist
Name Attribute in DirSync Configuration
This document outlines new features and functionality in the ‘WebAdmin’ and ‘Profile Manager’ interfaces for the Netsweeper 6.3 Release.
See also 6.3 Release Notes and New Features 6.3 Summary.
All WebAdmin tables can be toggled between a Tile and Table view. In addition, you can also now drag and drop to reorder columns when in Table view. This allows you to customize the view of each page to better suit your requirements.
In 'Table View', click the Table/Tile View button.
The 'Tile View' displays.
The default Session Store can be set for all users when they first log in. This allows you to change the interface, or the default page they see, or even change searches and other settings stored in the Session Store. Currently there is no interface to copy settings from an Account or manually delete settings from the Account or default session store.
There are new WebAdmin Search Options:
Option |
Description |
Contains All |
This takes each space separated word and searches for a match for each; if all words have a match, results will be shown (logical AND). |
Contains Any |
This takes each space separated word and searches for a match for each; if any words have a match, results will be shown (logical OR). |
Example
Option |
Input |
Finds |
Match |
a b |
a b a b c |
Exact Match |
a b |
a b |
Contains All |
a b |
ab a b a b c |
Contains Any |
a b
|
a b ab a b a b c |
Client and Policy columns have been removed from the Group Manager List. New columns: Description, Deny Page (Yes/No), Logging Mode, Logfile Tag, Timezone, Language, Override, Enforced Categories, and Auth Redirect have been added.
The menu in the 'Moved IP Address Expire Time' field on the Group Authentication Redirect page can now be set for Minutes, Hours, Days, and Weeks to offer longer moved IP expire times.
A 'Last Changed' column showing when the Client was created or modified has been added to the 'Client Manager'.
You can now assign all Groups managed by the logged in user when creating a SysOp Account. A new checkbox, 'Assign to all managed groups' has been added to the Account Manager Create tab.
Permission templates are now Account Templates. Use this window to modify an Account Template. The General tab lets you modify the name and select the template type. The Permissions tab allows you to select the permissions you wish to apply. The IP Restrictions tab can restrict a template to specific IP ranges. Use the Groups tab to assign the Account Permission template to one or more Groups. When done, click Submit.
Click the Create button.
Enter the Template Name, select the 'Template Type' and click the Submit button.
The Screen displays with four tabs: General, Permissions, IP Restrictions, and Groups.
The Permissions tab lets you assign permissions to the Template. You can also copy permissions from an existing Account Template.
The IP Restrictions tab can restrict a template to specific IP ranges (e.g. 192.168.0.0/24 or 10.0.0.5-10.0.0.17)
The Groups tab lets you assign the selected Account Template to one or more Groups.
The Report Wizard has been removed and has been replaced by the Custom Report.
There is now the ability to view the 'trends' between a configurable number of report instances. Two new fields: 'Trend Fields' and 'Trend Depth' have been added to Summary Groups for Scheduled Reports. The data indicates a trend for the selected Counter through the previous reports.
Options |
Description |
Change
from Previous |
The Counter shows the relative difference from the previous instance. |
Average |
The average value among the previous values including the current value. |
Change
from Average |
The relative change from Average. |
Standard deviation (Counter or Percent) |
Standard deviation (square root of Variance) |
Change to Deviation Rate |
Change from Average in comparison to the Standard deviation |
Linear Regression Slope |
The slope of the Linear regression line. |
Change
from Linear Regression |
Change from the calculated trend. |
The number of instances (in a row) used for the trend calculation
· Any one of the Trend indicators can be used in conjunction with any Counter or Percent column: Total Requests, Requests Allowed, Requests Denied, Total Pages, Pages Allowed, Pages Denied, Total Files, Files Allowed, Files Denied, Request Percent, Page Percent, File Percent.
· Although some trend columns use other columns results (e.g. "change from Average in comparison to the Standard deviation") you can specify only the final column and the script implicitly will calculate all needed intermediate results.
· Any Trend column can be used for rows ordering.
· The Trend columns should be correctly calculated in any level nested Summary Group but can significantly slow down calculation because of internal structure of multi-level grouped instances. Therefore, it is recommended to use such columns only in the top-level grouping.
A 'Timeline' view has been added to the Custom Report Presentation Table view.
This is an example of a Timeline Report Presentation.
The 'Table' view has a new 'Chart' column with a 'Show' link that can display the Chart if desired.
Demand, Scheduled, and Continuous Reports can now show the Report in 'Tile' View. The 'Table' view has a new 'Chart' column with a 'Show' link that can display the Chart if desired.
'GZipped CSV' has replaced 'Zipped CSV' in the WebAdmin in order to better stream the download process.
When viewing the Demand, Scheduled or Continuous Reports windows, you can now use the Filter icon to filter for the type of Reports you wish to view. Click the Filter icon and click the Add Filter link.
A Settings button has been added to the 'Create Report' and 'Quick Search' windows to set the 'Domain Definitions' and 'Average Page Browsing Time'.
You can now view large amounts of data in the Report tables. Column views have been improved and word wraps have been implemented.
Two new columns: 'Edited At' and 'View Count' have been added to the Reports windows.
The Category selection option in the 'Quick Search' window…
…has been replaced with a better selection function.
There is a new WebAdmin Setting, 'Maximum WebAdmin Report Table Rows' that allows you to specify the maximum number of rows that will be displayed for Summary and Detail tables in the WebAdmin for Reports.
A 'URL Lookup' button has been added to the edited entry input in the 'Review List' and 'Edit Entry' window. This button is only shown if the 'Entry Type' is URL and the 'Action' is Categorize.
The URL List Manager, in Review mode, now looks for similar entries in the current list and in the Merge List if it is set. Clicking the 'Identical Entry' link displays a table with the List entry allowing you to lookup the found URL.
There is a new WebAdmin Setting in 'General Limits' called 'Maximum URLs to Lookup at once' that allows you to set the number of URLs the URL Lookup tool tries to lookup at once.
Option |
Description |
Maximum URLs to Lookup at once |
This sets the number of URLs the URL Lookup can lookup at once. It is used in URL Lookup and for Merge Lists. |
There are two new Check Rules. The 'URL Convert to Path' rule warns you that you may be creating a path by using a forward slash in the URL. The 'URL Convert to Query' warns you that a question mark may indicate you are creating a path.
Warn users when creating a URL type entry which starts with a forward slash. This will be automatically converted to a Path type entry.
Warn users when creating a URL type entry which starts with a question mark. This will be automatically converted to a Query type entry.
The items in the List Actions dropdown have been updated.
Old Term |
New Term |
Allow URL |
Allow |
Deny URL |
Deny |
Assign Category |
Categorize |
Replace |
Replace |
Edit URL Query |
Modify Query |
Search and Replace |
Search and Replace |
Regular Expression |
Regular Expression |
Add Request Header |
Modify Header |
Proceed to List |
Proceed to List |
The 'Protocol and Server IP' name in the Request Part of the URL List Entry window has been changed to 'Server IP'.
This section contains new additions or modified text in NSProxy Settings.
ICAP Connection counters have been added for connects, disconnects, connect timeouts and read timeouts.
This timeout is for reading icap responses from a policy server
Default: icap_timeout_read 5sec
Format: icap_timeout_read seconds
This timeout is for icap connections to a policy server
Default: icap_timeout_connect 5sec
Format: icap_timeout_connect seconds
Format: icap_channel NAME
NAME->server hostname [port] [path]
NAME->server_connections number
NAME->reconnect_delay milliseconds
NAME->max_queue_size number
NAME->max_retry number
NAME->timeout_read
NAME->timeout_connect
The NSProxy can now keep the nfmark or the ip tos field from client to remote server. In addition, the Policy Service can now read the request context IP address from the ICAP header X-Context-IP. This allows the NSProxy to communicate the request context via the ICAP channel rather then creating new ICAP channels for each request context.
These new setting have been added to NSProxy Settings.
Option |
Description |
context=<IPAddress> |
This allows you to set a Request Context IP address which will override the connection IP in ICAP. This setting only will work if you use an ICAP policy channel, and it will always override the connection IP address. This allows a specific NSProxy Listen port to be bound to a specific request context allowing for easier filtering of overlapping IP changes on a single NSProxy system. |
nfmark=[yes|no] |
Enables per-port nfmark lookup on source connection and setting on destination connection. This allows you to keep a mark between client and the remote server thru NSProxy. |
iptos=[yes|no] |
Enables per-port IP TOS lookup on source connection and setting on destination connection. This allows you to keep the IP TOS field between client and the remote server thru NSProxy. |
NSProxy can fail open/close when processing a very large HTTP request header. NSProxy will now truncate the HTTP request header to avoid a fail open/fail close state. We will truncate the path/host and remove optional http headers.
These settings have been added to NSProxy Settings:
HTTP Host/Path Policy Settings
Maximum http host size sent to policy servers.
Default: policy_max_http_host_length 256
Format: policy_max_http_path_length integer_value
Maximum http path size sent to policy servers.
Default: policy_max_http_path_length 7920
Format: policy_max_http_path_length integer_value
Maximum policy request length
Default: policy_max_request_length 16384
Format: policy_max_request_length integer_value
There are new NSProxy settings to bind the proxy to a CPU node and bind NSProxy threads to specific CPU cores.
Bind nsproxy to a specific CPU Socket for memory allocation. The node number starts and 0 and increments, see numactl --hardware
Default: proxy_node -1
Format: proxy_node 0
Proxy Thread CPU Affinity, Scheduler, and Priority Settings. Default settings are not set. Settings dumped when set. For each thread proxy_thread[X] has the following settings.
proxy_thread[0]->thread_affinity [ ALL | cpuno ] [ cpuno ] ...
Sets which CPU this thread can run on. Starts at index of 1 and goes up to the number of CPU's on the system. ALL for any
proxy_thread[0]->thread_priority 0
The priority of this thread, -19 highest and 20 lowest 0 is the default.
proxy_thread[0]->thread_scheduler [ SCHED_RR | SCHED_FIFO | SCHED_BATCH | SCHED_OTHER ]
Change the Scheduler used for the logger thread.
There is a new WebAdmin interface, that allows users to enter per brand settings for the Client Filter. Previously this was done through Policy Server Settings. ou now create the Brand and then modify the settings.
Go to System Tools > System Configuration and click Client Filter Settings.
In the Client Filter Settings window, click the Add Brand button.
Enter the Brand name and click Submit.
The Modify window display.
Two settings have been moved from 'WebAdmin Settings' to the 'Client Filter Settings' window: 'Global Uninstall Password' and 'Override Profile Manager Password'.
There are new options found in the 'Agent Config Manager' window.
There is a new WAgent configuration option: Add Name Based Client. It will create a name-based Client when a Client is added for WAgent. Note: This will only work if 'Client Name Type' is not set to 'No duplicated Client Names allowed' in WebAdmin Settings.
There is a new WAgent configuration option: Expire Client on Logout that will expire the Client session instead of deleting it.
There is a new option: 'Create group with default setting if it doesn't exist' that assigns SysOp Accounts to groups created by the WAgent. This option only displays if System Group Name or Environment Variable is selected. When the option is checked, a new Managers field displays. Select from the list of Manager Accounts in the dropdown.
There is now the ability to use the Name Attribute for the Azure and Google directory sync in 6.3.6 and above for the WebAdmin and for the Directory Sync Service. A 'Name Attribute' field has been enabled.
The 'Name Attribute' changes the attribute used for the Client's Username when synchronizing users into the WebAdmin.
The table below shows the tested and supported attributes that can be synchronized some examples of usernames that can be used to sync. For different deployments, different attributes can be used.
Attribute |
Directory Type |
Example |
sAMAccountName |
Active Directory |
user.name |
userPrincipalName |
Active Directory |
user.name@example.com |
cn |
Active Directory |
user.name |
name |
Active Directory |
user.name |
distinguishedName |
Active Directory |
CN=sally evens,CN=Users,DC=ntlmforest,DC=com |
cn |
Novel eDirectory |
realuser6 |
uid |
Novel eDirectory |
realuser6 |
name |
Google Directory |
sally_evens |
Google Directory |
user.name@example.com |
|
Azure Directory |
user.name@example.com |
|
name |
Azure Directory |
sally_evens |
userPrincipalName |
Azure Directory |
|
signInName |
Azure Directory |
|
mailNickname |
Azure Directory |
|
A 'Name Attribute' has been added the Azure Directory Sync. It changes the attribute used for the Client's Username.
A 'Name Attribute' has been added the Google Directory Sync. It changes the attribute used for the Client's Username.
There are two new WebAdmin Setting in the 'General Settings' section: WebAdmin Unavailable Deny Page DPID and WebAdmin Secure Deny Page DPID. They are used to configure the global deny page DPID for the unavailable and secure deny page. This can be changed from the default to service different default deny pages for different deny page hosts.
Option |
Description |
WebAdmin Unavailable Deny Page DPID |
This is used to configure the Global Deny Page DPID for unavailable Deny Page. This can be changed from the default to service different default deny pages for different deny page hosts. The number entered is the Deny Page ID from the database. If you hover over or click edit on a deny page and open in a new browser window, you can see the DPID. |
WebAdmin Secure Deny Page DPID
|
This is used to configure the Global Deny Page DPID for Secure Deny Page. This can be changed from the default to service different default deny pages for different deny page hosts. The number entered is the Deny Page ID from the database. If you hover over or click edit on a deny page and open in a new browser window, you can see the DPID. |
In Report Settings, Module Name, Screenshot, and Workstation Name can now be enabled in 'Report Settings'.
They have been added to 'Policy Server Settings'.
And to Request Log Files.
In WebAdmin Settings > Category Settings, three fields: Category Views, Default Category View and Category Group/Block View Columns have been removed as they are no longer used by the WebAdmin.
A 15-minute (900 seconds) WebDB cache is now enabled by default in WebAdmin Settings.
WebAdmin Name |
Internal Name |
Description |
List Search |
perm_list_search |
This gives a SysOp access to List Search. It allows a SysOp to browse List Entries from all Lists the SysOp has permission to view. The List Search can be used to view both Local and Shared Lists and from the List Search page, SysOps can edit or delete entries if they have permission to do so. |
Manage User Accounts |
perm_manage_user_account |
This allows a SysOp to create, edit and delete User Accounts. |
These Admin Permissions: Global Language Change and SAML2.0 Authentication Settings have been added WebAdmin permissions.
WebAdmin Name |
Internal Name |
Description |
Global Language Change |
perm_global_language_change |
This allows an Admin to change the global Language. |
SAML2.0 Authentication Settings |
perm_samlauth_settings |
This allows an admin to manage the SAML2.0 Authentication Settings. |
The list below shows new Categories added in 6.3. In addition, 'Child Pornography' has been renamed to 'Child Sexual Abuse'.
[ C77] Bullying (webadmin,reporter)
This category includes hostile and deliberate content that seeks to aggressively dominate, intimidate, harm, or coerce. Content that threatens, harasses or socially excludes individuals or groups is included in this category.
[ C112] Child Erotica (webadmin,reporter)
This category contains non-pornographic material of children that is used for sexual purposes. This category is broader than child sexual abuse material (CSAM), incorporating material that may cause sexual arousal such as nonsexual but suggestive images or depictions of children. On the COPINE scale, this category contains Posing, Erotic Posing, and Explicit Erotic Posing.
[ C113] Child Sexual Abuse (webadmin,reporter) (Formerly Child Pornography)
This category contains content of child sexual abuse material (CSAM) or content related to child sexual molestation. This includes forms of child abuse in which an adult or older adolescent uses a child for sexual stimulation. Forms of child sexual abuse include engaging in sexual activities with a child, child grooming, child sexual exploitation or using a child to produce child pornography. On the COPINE scale, this category contains Explicit Sexual Activity, Assault, Gross Assault, and Sadistic/Bestiality.
[ C143] Terrorism (webadmin,reporter)
This category contains content that promotes the illegal use, action or process of violence against civilians or a spectrum of society for the purpose of societal and/or political change.
[ C98] IWF NPI (reporter)
Sites in this category have been identified by the Internet Watch Foundation as containing Non-Photographic Images potentially depicting illegal child abuse. URLs in this category are omitted from all reports. This list is not managed by Netsweeper. For more information, see IWF's website at http://www.iwf.org.uk/
[ C312] Tango (webadmin,reporter)
This Category is used for the Tango application.
[ C311] Viber (webadmin,reporter)
This Category is used for the Viber application.
[C 313] WeChat (webadmin,reporter)
This Category is used for the WeChat application.
[ C314] OpenVPN (webadmin,reporter)
This Category is used for the OpenVPN protocol.
[ C315] PPTP (webadmin,reporter)
This Category is used for the Point to Point Tunneling Protocol (PPTP).
MIB |
Description |
icapConnectTimeouts |
Number of connect timeouts |
icapReadTimeouts |
Number of read timeouts |
icapConnects |
Number of connects |
icapDisconnects |
Number of disconnects |
icapRetriedRequests |
Number of retried requests |
View these API.(New Window)
This assigns an IP range to a SysOp Account.
This API toggles the restrict group lookup flag on a Request Server. When enabled, this option will restrict group lookups from this request server to clients with the same @organization in their name. The request server does not need to be active for this restriction to be processed.
The groupname and defaultgroup fields are no longer required.